What the standard says
DMARC is defined by the Internet Engineering Task Force in RFC 9989, published in May 2026, which replaced the older RFC 7489 [1]. It builds on two other email checks, SPF and DKIM, and connects them to the address your recipients actually see in the “From” line [1].
A DMARC record sets one of three policies [1]:
none: you’re not asking receivers to do anything different. The standard calls this “monitoring mode.” You get reports, but failing mail isn’t treated differently because of your policy.
quarantine: you consider failing mail suspicious. Receivers will often send it to spam.
reject: you consider failing mail a clear sign someone is misusing your domain. Receivers can refuse it.
The record can also include an address for aggregate reports, the “rua” setting. Receivers send these reports, usually once a day, showing which servers sent mail using your domain and whether it passed [1].
The standard, Google and Microsoft all describe the same path: start at “none,” read the reports, fix any of your own mail that fails, then move to quarantine and finally reject [1][3][4]. Google asks Workspace customers to wait 48 hours after setting up SPF or DKIM before adding DMARC [3]. Microsoft suggests starting with low-volume domains and leaving the main domain for last [4].
One detail is changing. Microsoft’s setup guide still shows a “pct” setting for rolling out gradually [4]. The new standard removed it and added a “t” (test) flag that does a similar job [1].
Gmail requires DMARC only for bulk senders, meaning those sending more than 5,000 messages a day to Gmail accounts, and a policy of “none” meets that requirement [2].
What you’ll hear
“Without DMARC, anyone can send email as you, and your customers will stop trusting you overnight.”
Part of that is true. Without an enforced DMARC policy, it’s easier for someone to send mail that shows your exact domain in the “From” line, and some receivers will deliver it. For a business whose customers pay invoices or send sensitive files by email, that’s a real risk worth closing.
The “overnight” part is overstated, and DMARC isn’t a cure for email fraud. The standard itself says it only addresses spoofing of your exact domain, not lookalike domains or a fake display name [1]. It also does nothing about a real mailbox that has been broken into.
What the numbers say
The FBI reports $55.5 billion in exposed losses from business email compromise worldwide between October 2013 and December 2023 [5].
Publisher: FBI Internet Crime Complaint Center (IC3), public service announcement, September 2024 [5].
Sample: 305,033 incidents reported to the FBI and through other channels, from all 50 states and 186 countries [5].
Funder: U.S. government.
Fit for a small business: limited. The figure covers organizations of every size and every form of the scam. The FBI describes business email compromise as compromising “legitimate business or personal email accounts” [5], which DMARC doesn’t prevent. The figure isn’t broken out by method, so it can’t tell you how much of the loss DMARC would have stopped.
We haven’t found a primary source that measures how often small businesses’ own domains are impersonated, so this page doesn’t give a number for it.
What we’ve seen
When we set up DMARC for clients, the biggest benefit usually isn’t stopping an attacker. It’s what the reports reveal. Most businesses have more services sending email in their name than they realized: the billing system, a scheduling tool, a copier that scans to email, a newsletter platform. Getting each one to pass gives the business a clear picture of how its email actually works, often for the first time.
Once those services pass and the policy moves past “none,” we’ve seen fewer messages to customers and vendors land in spam, and the domain’s reputation with the big email providers improves. That fits Gmail’s own sender guidelines, which set authentication requirements for anyone sending to Gmail [2]. Results vary from business to business, but typically, we notice improvements all the way around.
Putting it together
DMARC closes one specific door: someone sending mail as your exact domain. It’s free, it’s a DNS record, and every major email provider recommends it [1][3][4]. It’s worth doing carefully and in steps, because jumping straight to “reject” can block your own invoices or newsletters. It’s one layer of protection. MFA, staff awareness and a habit of confirming payment changes by phone matter just as much.
What good looks like
A DMARC record exists for every domain that sends email, including a reports address you or your IT provider actually read.
Every service that sends mail as you (Microsoft 365 or Google, your billing system, your newsletter tool) passes SPF or DKIM and is aligned with your domain.
Your policy has moved past “none” to “quarantine” or “reject,” without your own mail being blocked.
Domains you own but don’t send from are set to “reject,” so they can’t be used against you.
Questions for your IT resource
Do all of our domains have a DMARC record, and who reads the reports?
Which services send email as us, and do they all pass?
What’s our current policy, and what’s the plan to move past “none”?
Are the domains we don’t use for email locked down with “reject”?
Related learning
What is SPF, and why one record matters
SPF is a DNS record that lists the servers and services allowed to send email for your domain. Receiving mail servers check it to decide whether a message really came from someone you approved.
DKIM, explained without the jargon
DKIM adds a digital signature to every email you send. Receiving servers check it against a key in your DNS to confirm the message came from your domain and wasn’t changed along the way.
What is MFA, and why a password isn’t enough
MFA, short for multi-factor authentication, asks for a second proof after your password, like a prompt on your phone or a security key. A stolen password alone is no longer enough to sign in.
Sources
IETF, RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC), May 2026. (checked 2026-10-05)
Google, Email sender guidelines, Gmail Help. (checked 2026-10-05)
Google, Set up DMARC, Google Workspace Help. (checked 2026-10-05)
Microsoft, Set up DMARC to validate the From address domain, Microsoft Learn. (checked 2026-10-05)
FBI IC3, Business Email Compromise: The $55 Billion Scam, September 2024. (checked 2026-10-05)
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.